Subject: [keyassure] Sample code

From: "Richard L. Barnes" <[email-masked]>
Date: Mon, 23 Aug 2010 16:04:43 -0400

Speaking, as Phillip was, of the importance of people writing code,  
here's a little bit of sample code that illustrates why it's handy to  
have the full cert in the DNS.  (Even though it is, I acknowledge,  
more than one needs, and does raise issues with certificate expiry.)   
Namely, you can reduce implementation of DNSSEC-assured TLS keying to  
around 10 lines.

CAVEAT EMPTOR: I haven't tested this, but at least it compiles and  
links against libunbound and openssl.

-----BEGIN-----
#include <unbound.h>
#include <openssl/ssl.h>

void keyassure(char *name, SSL_CTX *ctx) {
     // Obtain the CERT record from DNS, secured with DNSSEC
     struct ub_ctx *dns_ctx = ub_ctx_create();
     struct ub_result *result;
     ub_resolve(
     	dns_ctx, name,
     	37, // TYPE CERT
     	1,  // CLASS IN
     	&result
     );

     // If we got a DNSSC-signed CERT record, add it to the SSL CA list
     if (result->secure && result->havedata) {
     	// Read the X509 bytes into an OpenSSL X509 object
     	// Skip 5 bytes of type/tag/algorithm in the rrdata
     	unsigned char *cert_data = (unsigned char*) result->data[0] + 5;
     	int cert_len = result->len[0] - 5;
     	X509* cert = d2i_X509(NULL, cert_data, cert_len);
     	
     	// Mark the cert as a trusted CA cert
     	SSL_add_client_CA(ctx, cert);
     }
}

int main(int argc, char **argv) {
     if (argc < 2) return 1;
     SSL_CTX *ctx = SSL_CTX_new(TLSv1_method());
     keyassure(argv[1], ctx);
     // Finish setting up context and make SSL connection...
}
-----END-----

---

From: Warren Kumari <[email-masked]>
Date: Tue, 24 Aug 2010 15:36:04 -0400

On Aug 23, 2010, at 4:04 PM, Richard L. Barnes wrote:

> Speaking, as Phillip was, of the importance of people writing code, here's a little bit of sample code that illustrates why it's handy to have the full cert in the DNS.  (Even though it is, I acknowledge, more than one needs, and does raise issues with certificate expiry.)  Namely, you can reduce implementation of DNSSEC-assured TLS keying to around 10 lines.

Wow, that's kinda sexy...

W

> 
> CAVEAT EMPTOR: I haven't tested this, but at least it compiles and links against libunbound and openssl.
> 
> -----BEGIN-----
> #include <unbound.h>
> #include <openssl/ssl.h>
> 
> _______________________________________________
> keyassure mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/keyassure

---

From: Scott Schmit <[email-masked]>
Date: Wed, 25 Aug 2010 19:34:02 -0400

>     	SSL_add_client_CA(ctx, cert);

For what it's worth, depending on the context of this code, this could
be a very bad thing to do. For example, if this is a CA certificate and
another site presents a certificate signed by this one (but without
DNSSEC, etc), it will be accepted as valid.

In other words, I don't think you can validate the certificates from DNS
without taking into account the domain they are bound to, or you lose
the benefit of this exercise.

---

From: Warren Kumari <[email-masked]>
Date: Wed, 25 Aug 2010 21:01:11 -0400

> DNSSEC, etc), it will be accepted as valid.

Yes -- I don't think that this was intended to actually be used, but rather just an example of how easily stuff like this <waves hands around> can be done...

---

From: "Richard L. Barnes" <[email-masked]>
Date: Wed, 25 Aug 2010 21:55:20 -0400

Yeah, there's more than a couple of things missing from this example  
(bounds checking, for example!).

With respect to Scott's specific concern, I was thinking that this SSL  
context would only be used for connection in question, in which case  
it's just an issue of semantics: Whether having the cert in the DNS  
means that the host at that name will present exactly that cert or a  
cert subordinate to it.

On Aug 25, 2010, at 9:01 PM, Warren Kumari wrote:

> Yes -- I don't think that this was intended to actually be used, but  
> rather just an example of how easily stuff like this <waves hands  
> around> can be done...
>
>>